# MITRE ATT&CK: The Blue Team Analyst's Framework

# MITRE ATT&CK: The Blue Team Analyst's Framework

If you've spent any time in a SOC or reading threat intel reports, you've seen MITRE ATT&CK. It's the shared vocabulary blue teamers use to describe what attackers do. This post covers what ATT&CK is, how to use it for detection engineering, and the complementary projects that extend it.

---

## What is ATT&CK?

MITRE **ATT&CK** stands for **Adversarial Tactics, Techniques, and Common Knowledge**. It's a globally accessible knowledge base of adversary behaviors derived from real-world observations.

- Started in 2013 from MITRE's Fort Meade Experiment (FMX)
- Security pros emulated APT TTPs against a network, documented observed behaviors
- Initially Windows-focused, now covers macOS, Linux, cloud, mobile, and ICS
- As of v18: 14 tactics, 216 techniques, and 475 sub-techniques (numbers grow with each release)

---

## Tactics, Techniques, Procedures (TTPs)

ATT&CK is built around three layers:

- **Tactics**: the adversary's goal ("why")
- **Techniques**: the method used to achieve that goal ("how")
- **Procedures**: specific implementations by threat groups ("what exactly")

Example:
- Tactic: **Credential Access**
- Technique: **OS Credential Dumping** (T1003)
- Sub-technique: **LSASS Memory** (T1003.001)
- Procedure: APT28 uses Mimikatz to dump LSASS

---

## The Enterprise Matrix, 14 Tactics

The order roughly follows an attack lifecycle:

```
1. Reconnaissance
2. Resource Development
3. Initial Access
4. Execution
5. Persistence
6. Privilege Escalation
7. Defense Evasion
8. Credential Access
9. Discovery
10. Lateral Movement
11. Collection
12. Command and Control
13. Exfiltration
14. Impact
```

Each tactic column contains dozens of techniques. Click any technique in the matrix for:

- Description
- Procedure examples (which groups have used it)
- Data sources for detection
- Detection guidance
- Mitigations

---

## ATT&CK Navigator

The [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/enterprise/) is a visual tool for exploring and annotating the matrix.

### Use Cases

- **Compare threat groups**: overlay APT28 and APT29 layers to see overlapping TTPs
- **Map defensive coverage**: highlight techniques your detections cover vs. gaps
- **Plan red/blue team exercises**: scope which techniques to test
- **Visualize incident frequency**: color techniques by how often you see them

The Navigator generates JSON layers that can be exported, shared, and versioned.

---

## ATT&CK vs Cyber Kill Chain

People often ask which to use. They solve different problems.

| Aspect | ATT&CK | Cyber Kill Chain |
|--------|--------|------------------|
| **Structure** | Matrix of techniques per tactic | Seven sequential stages |
| **Granularity** | Specific techniques case-by-case | Generic attack phases |
| **Updates** | Continuously updated | No updates since 2011 |
| **Focus** | Detailed behavioral analysis | High-level attack progression |
| **Best for** | Detection engineering, TTP mapping | Executive reports, strategic view |

Many SOC teams use a hybrid approach. The **Unified Kill Chain (UKC)** combines both into 18 phases.

---

## Complementary MITRE Projects

ATT&CK doesn't exist alone. MITRE has several related projects that extend it.

### CAR (Cyber Analytics Repository)

Pre-built detection analytics mapped to ATT&CK techniques.

- Pseudocode and tool-specific implementations (Splunk, EQL, Sigma)
- Validated analytics with operating theory and rationale
- An ATT&CK Navigator layer showing analytic coverage

**Use it when:** you need a starting point for writing detections, CAR gives you reference logic.

### MITRE Engage

A framework for **adversary engagement**: active defense through denial and deception.

- **Cyber Denial**: preventing adversary operations
- **Cyber Deception**: misleading adversaries with intentional artifacts (honey tokens, decoy files)
- Five categories: Prepare, Expose, Affect, Elicit, Understand

### D3FEND

**D**etection, **D**enial, and **D**isruption Framework Empowering **N**etwork **D**efense.

- Knowledge graph of defensive countermeasures (originally NSA-funded)
- 267 defensive techniques across 7 tactics (Model, Harden, Detect, Isolate, Deceive, Evict, Restore)
- 680+ digital artifacts mapped to ATT&CK techniques
- Complements ATT&CK by mapping defenses to offensive techniques

Think of it as "ATT&CK for defenders", defensive techniques are directly mapped to the offensive techniques they counter.

### Adversary Emulation Plans

Published by MITRE Engenuity's Center for Threat-Informed Defense (CTID).

- Step-by-step plans to emulate specific threat groups (APT3, APT29, FIN6)
- Let organizations test defenses against real-world adversary behaviors
- Open-source on GitHub

---

## Practical Use in a SOC

Here's how a blue team analyst actually uses ATT&CK day-to-day:

### 1. Threat Intelligence → Detection

- Read a threat intel report about a new APT campaign
- Extract the TTPs mentioned (e.g., "uses PowerShell for execution, LSASS dumping for credential access")
- Map them to ATT&CK techniques (T1059.001, T1003.001)
- Check which of these you detect today, fill the gaps

### 2. Incident Investigation

- During an investigation, classify every adversary action by ATT&CK technique
- Build a timeline showing the technique progression
- Share findings using technique IDs, every analyst immediately understands

### 3. Detection Engineering Workflow

```
Identify target technique → Research detection data sources 
→ Write rule (Sigma, Splunk SPL, Elastic EQL) → Test with emulation 
→ Deploy to production → Monitor false positive rate
```

### 4. Coverage Assessment

- Export your current detection rules
- Map each rule to ATT&CK techniques
- Load into Navigator
- Visualize coverage, find critical gaps
- Prioritize new rules based on threat intel + asset criticality

### 5. Red/Blue Team Exercises

- Red team picks a threat group (e.g., APT29)
- Uses CTID's emulation plan to replicate their TTPs
- Blue team practices detection, alerts get reviewed
- Map detected vs missed techniques on Navigator
- Post-exercise: build detections for the misses

---

## Example Analyst Workflow

Scenario: threat intel report says APT33 is targeting your industry.

1. Open [attack.mitre.org/groups/G0064](https://attack.mitre.org/groups/G0064/), the APT33 group page
2. Note their techniques: spearphishing (T1566), PowerShell (T1059.001), credential dumping (T1003)
3. Open ATT&CK Navigator, create an "APT33" layer
4. Overlay your existing detection coverage layer
5. Identify gaps where APT33 has techniques you don't detect
6. Check CAR for reference analytics on those techniques
7. Write Sigma rules or Splunk queries for your SIEM
8. Test with Atomic Red Team or a custom emulation
9. Deploy and monitor

---

## Key Takeaways

- ATT&CK is the **shared language** for describing attacker behavior
- Structure: **Tactics** (why) → **Techniques** (how) → **Procedures** (what)
- Use the **Navigator** for visual TTP mapping and coverage analysis
- ATT&CK and Kill Chain solve different problems, use both
- **CAR** gives you reference detection analytics
- **D3FEND** maps defenses to offensive techniques
- **Adversary Emulation Plans** let you test against real TTPs
- ATT&CK is the glue between threat intel, detection engineering, and IR